CVE-2026-23925
Description
A flaw was found in Zabbix. An authenticated user with the 'User' role, who also possesses write permissions for templates or hosts, can exploit the configuration.import API. This allows them to create unauthorized objects, such as hosts, which can lead to a loss of confidentiality within the system.
Statement
This MODERATE impact vulnerability in Zabbix allows an authenticated user with template/host write permissions to create unauthorized hosts via the configuration.import API. This bypasses the normal restrictions for the 'User' role, which typically prevents such users from creating or editing templates and hosts.
Mitigation
To mitigate this issue, enforce strict role-based access control within Zabbix. Ensure that low-privilege users, especially those with the 'User' role, are not granted template or host write permissions that could be exploited via the `configuration.import` API for unauthorized host creation. Regularly audit user permissions to adhere to the principle of least privilege.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
